Online security experts have called for greater efforts to protect internet users, amid rising concerns that adverts on popular websites are being used by criminals as a way to target unsuspecting web users.

The calls come after a spate of so-called "malvertising" attacks - in which fake ads are placed on well-known websites as a way to reach millions of people through names they trust. Sites hit by a series of recent strikes include the New York Times and Horoscope.com, each of which receive millions of visitors every day.

Unlike traditional spam or virus attacks, which rely on victims clicking on a link in an email or mistakenly downloading an infected program, malvertising attacks are often hidden on popular websites and can sometimes even inject malicious code directly to a computer as soon as the target sees the compromised commercial.

"This is a growing problem," said Graham Cluley, a consultant with online security firm Sophos. "Hackers are making more and more use of ad networks to distribute their attacks to users visiting legitimate well-known sites."

"These are not random attacks. When they infect third party ad networks they may not know precisely which website will end up displaying their ads - but, frankly, they don't care about that. The important thing for them is that they get eyeballs."

Malvertising was first identified by security experts several years ago, but the growing breadth of online advertising has made it more attractive to criminals as a way to reach millions of web users quickly and easily.

A string of incidents in recent weeks have stepped up concerns, including attacks last weekend where popular sites including rightwing news service the Drudge Report were hijacked by criminals. The attackers succeeded in placing malicious ads through Google's DoubleClick service, which were then syndicated around a range of different sites.

The previous weekend, readers of the New York Times - the world's biggest newspaper website - were subjected to a malvertising attack after hackers posed as a legitimate company in order to buy advertising space.

While the incidents are embarrassing for those companies which get caught out, they pose a very serious threat to the readers of those sites - many of whom are not running up-to-date virus protection.

"Attackers use online ads for the same reasons a legitimate company would do so," said Mary Landesman of web security firm ScanSafe.

"When an attacker can infiltrate an advertising network, it enables them to reach a broad number of websites within a chosen category. This provides the attacker with the same return on investment that it would a legitimate advertiser – broad exposure to the audience of their choosing."

Among those lobbying for more awareness of the problem is Google executive Eric Davis, who heads up the company's anti-malvertising team. He told a security conference in Geneva yesterday that greater cooperation was required from internet providers to prevent the problem spiralling out of control.

"The internet service providers are in the best position to detect infected machines," he told the audience at Virus Bulletin conference. "They already have monitoring systems that could be used to identify signs of malware and botnet activity."

Other companies are taking more direct action: last week Microsoft filed a series of lawsuits against suspected malvertisers who used its services.

"Although we don't yet know the names of the specific individuals behind these acts, we are filing thee cases to help uncover the people responsible and prevent them from continuing their exploits," said Microsoft associate general counsel Tim Cranton.